Who is responsible for the data
Tal Yulzari and Arthur Kartun, Advocates, trading as Sod, are the controllers of personal data processed through this site. Contact details are on the contact page.
What data is collected, and why
| Data | When collected | Purpose | If you do not provide it |
|---|---|---|---|
| Name, organisation, email, telephone and a short description | When you submit the contact form | Replying and checking for conflicts | We cannot respond |
| Email address and assessment answers; name and organisation only if you give them | Only if you ask for the result by email | Sending you the result, and keeping a record of the request so we can reply if you contact us | We cannot send the result |
| Email address and consent record | After requesting a subscription and confirming by link | Sending updates, managing the subscription and recording consent | No updates will be sent |
| Page path and permitted campaign tags in the URL | When an active form is submitted | Understanding enquiry sources without advertising cookies | — |
| Technical request data, such as IP address and browser type | While browsing | Operating and securing the site through its host | — |
Providing data is voluntary. You are not required to provide anything; provision is a condition only of receiving the service offered on that screen.
AI assistant. Our lawyers use Claude, an AI assistant made by Anthropic, to prepare work on enquiries and client material. A lawyer reviews everything it produces. We use Claude on a business plan. Under Anthropic’s Commercial Terms, Anthropic does not train its models on content we submit. Anthropic is listed among the recipients below.
How long data is kept
The site does not store enquiries in a database. Messages sent through the site’s forms are delivered to the practice mailbox through the email provider.
- No engagement — an enquiry or result request is deleted two years after our last contact. A one-line record (name, organisation, date and subject) is kept for seven years, to check for conflicts of interest.
- Engagement — the enquiry and everything related to the matter become part of the client file, which is kept for seven years after the matter ends.
- Newsletter subscribers — the email address and the consent record (when and how consent was given) are kept while you are subscribed. After you unsubscribe, the address is marked as unsubscribed so that no further updates are sent to it, and it and the consent record are deleted seven years after the last newsletter sent to it.
Once a year we review what we hold and delete what is no longer needed.
An email address is added to the newsletter list only after the confirmation link is used. You may request removal at any time.
Your rights
- Access to data about you — section 13 of the Privacy Protection Law.
- Correction or deletion of data that is not correct, complete, clear or up to date — section 14.
- Unsubscribe from the newsletter — through the link in every message, or by writing to us through the contact page.
- Challenge a refusal — if an access or correction request is refused, you may apply to the Magistrates' Court under section 15 of the Law.
- Complain — you may lodge a complaint with the Privacy Protection Authority.
For a privacy rights request, use the contact details on the contact page.
Data security
When active, site forms are submitted over HTTPS to the email provider. Access to practice accounts is limited through their account controls. No system is entirely secure.
People in the European Union
If you are in the European Union, see the Annex for people in the European Union later in this notice, for processing bases, transfers and additional rights under the GDPR.
Changes
This notice may be updated. Previous versions are retained and provided on request.
Annex — people in the European Union
This annex applies if you are in the European Union when you provide the data. It supplements the notice above and does not narrow it.
Bases for processing (Article 6)
| Activity | Basis |
|---|---|
| Responding to an enquiry you initiated, and pre-engagement steps | Article 6(1)(b) — steps prior to entering a contract, at your request |
| Recording the enquiry and running a conflicts check | Articles 6(1)(c) and 6(1)(f) — a legal duty applying to a lawyer, and a legitimate interest in the proper administration of the practice |
| Sending your self-assessment result | Article 6(1)(b) |
| Keeping a record of the result request, so we can reply if you contact us | Article 6(1)(f) — a legitimate interest in answering follow-up enquiries |
| Sending the newsletter | Article 6(1)(a) — consent, withdrawable at any time |
| Keeping the consent record after you unsubscribe | Article 6(1)(f) — legitimate interest in proving consent if a legal claim arises |
| Operating and securing the site, and aggregate statistics | Article 6(1)(f) — legitimate interests |
No Article 9 special-category data is processed through the site's forms. Please do not enter medical, biometric or other sensitive data in a form.
Transfers
This practice is in Israel. The European Commission has recognised Israel as providing an adequate level of protection (Decision 2011/61/EU of 31 January 2011), a finding maintained in the review report COM(2024) 7 final of 15 January 2024. Transfers from the EU to Israel therefore rely on Article 45 and require no further transfer mechanism. The decision does not extend to law-enforcement-sector transfers.
Some recipients listed above, including Anthropic, process data in the United States. These onward transfers rely on the EU–US Data Privacy Framework where the provider is certified under it (Article 45), and otherwise on the European Commission’s standard contractual clauses included in the provider’s data-protection terms (Article 46(2)(c)). You can ask us for a copy of these safeguards. The two lawyers decide together how this data is used; either of them can be contacted about any request through the contact page.
Additional rights
Access (15), rectification (16), erasure (17), restriction (18), portability (20), objection to processing based on legitimate interests (21), and withdrawal of consent at any time (7(3)) without affecting the lawfulness of processing before withdrawal. There is no automated decision-making or profiling producing legal effects (22).
Complaints
You may complain to the supervisory authority of the member state of your habitual residence, place of work, or the place of the alleged infringement (Article 77).
Article 27 representative
This practice does not appoint an EU representative; if the processing comes within Article 3(2), this notice will be updated and the representative's contact details published.